SonarSource/sonarqube · warning

############################################################…

Error message

####################################################################################################################

What it means

DefaultAdminCredentialsVerifierImpl logs a highlighted warning banner when the default administrator credentials (admin/admin) are still valid on the running SonarQube instance. It is a security warning telling the administrator to change the default password or deactivate the default account.

Solutions

1. Log in as admin and change the default password immediately (My Account > Security, or Administration).
2. Deactivate the default admin account if unused and use a dedicated admin user.
3. Re-run the instance behind proper access controls until credentials are changed; the warning disappears once the default password no longer authenticates.

Example fix

// no code change; operational fix
// after
Administration > Security > change 'admin' password from 'admin' to a strong value

// verify default credentials are disabled before promoting an instance
curl -u admin:admin -o /dev/null -w '%{http_code}' http://localhost:9000/api/authentication/validate
# 200 means default admin/admin still works — change it

When it happens

Trigger: At server startup runAtStart() checks whether the default admin account still authenticates with password "admin" (via localAuthentication.authenticate); if successful, addWarningInSonarDotLog() emits the highlighted warning lines.

Common situations: Fresh SonarQube installations that were never hardened; demo/test instances promoted to production without changing the default admin password.

Related errors

• Default Administrator credentials are still being used…
• Authentication is not enforced, and permissions assigned to…
• Authentication is required
• Email ' ' is already used
• Failed to authenticate with login

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/fa5ab514992674b6. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/DefaultAdminCredentialsVerifierImpl.java:84

    try (DbSession session = dbClient.openSession(false)) {
      UserDto admin = getAdminUser(session);
      if (admin == null) {
        return false;
      } else {
        return isDefaultCredentialUser(session, admin);
      }
    }
  }

  private UserDto getAdminUser(DbSession session) {
    return dbClient.userDao().selectActiveUserByLogin(session, "admin");
  }

  private static void addWarningInSonarDotLog() {
    String highlighter = "####################################################################################################################";
    String msg = "Default Administrator credentials are still being used. Make sure to change the password or deactivate the account.";

    LOGGER.warn(highlighter);
    LOGGER.warn(msg);
    LOGGER.warn(highlighter);
  }

  private boolean isDefaultCredentialUser(DbSession dbSession, UserDto user) {
    try {
      localAuthentication.authenticate(dbSession, user, "admin", AuthenticationEvent.Method.BASIC);
      return true;
    } catch (AuthenticationException ex) {
      return false;
    }
  }

  private void sendEmailToAdmins(DbSession session) {
    if (dbClient.internalPropertiesDao().selectByKey(session, DEFAULT_ADMIN_CREDENTIAL_USAGE_EMAIL)
      .map(Boolean::parseBoolean)
      .orElse(false)) {
      return;

View on GitHub (pinned to 184c821202)